18 ms·

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of docume

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.

milkshakes 13y ago
again, it's not inconceivable that they understand this as well, and have some sort of rate limiting system in place. do you have a problem with google docs converting your office files?
- werid 13y ago
  There was a case awhile back where Google docs helped a guy rack up a huge AWS bill. http://www.behind-the-enemy-lines.com/2012/04/google-attack-how-i-self-attacked.html http://www.behind-the-enemy-lines.com/2012/04/google-attack-...
  - veidr 13y ago
    Wow that is an interesting blog post, with a happy ending to boot (Amazon refunded the $1000+ in bandwidth fees, due to the accidental nature of the usage).
danielweber 13y ago
There are lots of services that generate traffic on your behalf. A very general rule is that you should have to send at least as many bytes as the service does, lest you become a DDOS multiplier. I don't see a .doc file getting small enough to outsize a HTTP request inside of it, even if you used some funky compression, but I'm willing to hear otherwise. One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it.
- abstractbill 13y ago
  One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it. That does seem likely - dropbox tries to only upload diffs, when a file gets changed: https://www.dropbox.com/help/8/en https://www.dropbox.com/help/8/en
- abortz 13y ago
  Hi everyone, this is Andrew from Dropbox. We do use LibreOffice to render previews of Office documents for viewing in a browser, and have permitted external resource loading to make those previews as accurate as possible. While this could theoretically be used for DDoS, we haven’t seen any such behavior. However, just to be extra cautious we’ve temporarily disabled external resource loading while we explore alternatives.
  - helium 13y ago
    Hi Andrew, thanks for the explanation. Could Dropbox perhaps let me disable this feature? I almost never use the web interface so I wouldn't miss it and I prefer that my documents are not opened after being synched.
  - danielweber 13y ago
    As one part of your solution, I recommend restricting the machines that can make outbound requests to a certain pool, and then limit that pool's total bandwidth, throwing an alarm whenever the limit is hit. It may be that you are big enough that even the limited bandwidth you need for normal operations is enough to take out smaller hosts, so you'd need to measure and monitor to see how well this works.
  - deleted 13y ago
    [deleted]
  - inevitable 13y ago
    @helium: don't trust online storage. Simply encrypt your files with tools like boxcryptor to be sure dropbox (=the NSA) cannot read your files that easy.

milkshakes 13y ago

again, it's not inconceivable that they understand this as well, and have some sort of rate limiting system in place. do you have a problem with google docs converting your office files?

werid 13y ago
There was a case awhile back where Google docs helped a guy rack up a huge AWS bill. http://www.behind-the-enemy-lines.com/2012/04/google-attack-how-i-self-attacked.html http://www.behind-the-enemy-lines.com/2012/04/google-attack-...
- veidr 13y ago
  Wow that is an interesting blog post, with a happy ending to boot (Amazon refunded the $1000+ in bandwidth fees, due to the accidental nature of the usage).

danielweber 13y ago

There are lots of services that generate traffic on your behalf. A very general rule is that you should have to send at least as many bytes as the service does, lest you become a DDOS multiplier. I don't see a .doc file getting small enough to outsize a HTTP request inside of it, even if you used some funky compression, but I'm willing to hear otherwise. One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it.

abstractbill 13y ago
One question would be if you could upload the document once and then somehow trigger a very tiny edit that causes them to rescan it. That does seem likely - dropbox tries to only upload diffs, when a file gets changed: https://www.dropbox.com/help/8/en https://www.dropbox.com/help/8/en
abortz 13y ago
Hi everyone, this is Andrew from Dropbox. We do use LibreOffice to render previews of Office documents for viewing in a browser, and have permitted external resource loading to make those previews as accurate as possible. While this could theoretically be used for DDoS, we haven’t seen any such behavior. However, just to be extra cautious we’ve temporarily disabled external resource loading while we explore alternatives.
- helium 13y ago
  Hi Andrew, thanks for the explanation. Could Dropbox perhaps let me disable this feature? I almost never use the web interface so I wouldn't miss it and I prefer that my documents are not opened after being synched.
- danielweber 13y ago
  As one part of your solution, I recommend restricting the machines that can make outbound requests to a certain pool, and then limit that pool's total bandwidth, throwing an alarm whenever the limit is hit. It may be that you are big enough that even the limited bandwidth you need for normal operations is enough to take out smaller hosts, so you'd need to measure and monitor to see how well this works.
- deleted 13y ago
  [deleted]
- inevitable 13y ago
  @helium: don't trust online storage. Simply encrypt your files with tools like boxcryptor to be sure dropbox (=the NSA) cannot read your files that easy.